No Description
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

etc_dovecot_conf.d_10-auth.conf 5.1KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127
  1. ##
  2. ## Authentication processes
  3. ##
  4. # Disable LOGIN command and all other plaintext authentications unless
  5. # SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
  6. # matches the local IP (ie. you're connecting from the same computer), the
  7. # connection is considered secure and plaintext authentication is allowed.
  8. disable_plaintext_auth = yes
  9. # Authentication cache size (e.g. 10M). 0 means it's disabled. Note that
  10. # bsdauth, PAM and vpopmail require cache_key to be set for caching to be used.
  11. #auth_cache_size = 0
  12. # Time to live for cached data. After TTL expires the cached record is no
  13. # longer used, *except* if the main database lookup returns internal failure.
  14. # We also try to handle password changes automatically: If user's previous
  15. # authentication was successful, but this one wasn't, the cache isn't used.
  16. # For now this works only with plaintext authentication.
  17. #auth_cache_ttl = 1 hour
  18. # TTL for negative hits (user not found, password mismatch).
  19. # 0 disables caching them completely.
  20. #auth_cache_negative_ttl = 1 hour
  21. # Space separated list of realms for SASL authentication mechanisms that need
  22. # them. You can leave it empty if you don't want to support multiple realms.
  23. # Many clients simply use the first one listed here, so keep the default realm
  24. # first.
  25. #auth_realms =
  26. # Default realm/domain to use if none was specified. This is used for both
  27. # SASL realms and appending @domain to username in plaintext logins.
  28. #auth_default_realm =
  29. # List of allowed characters in username. If the user-given username contains
  30. # a character not listed in here, the login automatically fails. This is just
  31. # an extra check to make sure user can't exploit any potential quote escaping
  32. # vulnerabilities with SQL/LDAP databases. If you want to allow all characters,
  33. # set this value to empty.
  34. #auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@
  35. # Username character translations before it's looked up from databases. The
  36. # value contains series of from -> to characters. For example "#@/@" means
  37. # that '#' and '/' characters are translated to '@'.
  38. #auth_username_translation =
  39. # Username formatting before it's looked up from databases. You can use
  40. # the standard variables here, eg. %Lu would lowercase the username, %n would
  41. # drop away the domain if it was given, or "%n-AT-%d" would change the '@' into
  42. # "-AT-". This translation is done after auth_username_translation changes.
  43. #auth_username_format = %Lu
  44. # If you want to allow master users to log in by specifying the master
  45. # username within the normal username string (ie. not using SASL mechanism's
  46. # support for it), you can specify the separator character here. The format
  47. # is then <username><separator><master username>. UW-IMAP uses "*" as the
  48. # separator, so that could be a good choice.
  49. #auth_master_user_separator =
  50. # Username to use for users logging in with ANONYMOUS SASL mechanism
  51. #auth_anonymous_username = anonymous
  52. # Maximum number of dovecot-auth worker processes. They're used to execute
  53. # blocking passdb and userdb queries (eg. MySQL and PAM). They're
  54. # automatically created and destroyed as needed.
  55. #auth_worker_max_count = 30
  56. # Host name to use in GSSAPI principal names. The default is to use the
  57. # name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab
  58. # entries.
  59. #auth_gssapi_hostname =
  60. # Kerberos keytab to use for the GSSAPI mechanism. Will use the system
  61. # default (usually /etc/krb5.keytab) if not specified. You may need to change
  62. # the auth service to run as root to be able to read this file.
  63. #auth_krb5_keytab =
  64. # Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and
  65. # ntlm_auth helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt>
  66. #auth_use_winbind = no
  67. # Path for Samba's ntlm_auth helper binary.
  68. #auth_winbind_helper_path = /usr/bin/ntlm_auth
  69. # Time to delay before replying to failed authentications.
  70. #auth_failure_delay = 2 secs
  71. # Require a valid SSL client certificate or the authentication fails.
  72. #auth_ssl_require_client_cert = no
  73. # Take the username from client's SSL certificate, using
  74. # X509_NAME_get_text_by_NID() which returns the subject's DN's
  75. # CommonName.
  76. #auth_ssl_username_from_cert = no
  77. # Space separated list of wanted authentication mechanisms:
  78. # plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey
  79. # gss-spnego
  80. # NOTE: See also disable_plaintext_auth setting.
  81. auth_mechanisms = plain login
  82. ##
  83. ## Password and user databases
  84. ##
  85. #
  86. # Password database is used to verify user's password (and nothing more).
  87. # You can have multiple passdbs and userdbs. This is useful if you want to
  88. # allow both system users (/etc/passwd) and virtual users to login without
  89. # duplicating the system users into virtual database.
  90. #
  91. # <doc/wiki/PasswordDatabase.txt>
  92. #
  93. # User database specifies where mails are located and what user/group IDs
  94. # own them. For single-UID configuration use "static" userdb.
  95. #
  96. # <doc/wiki/UserDatabase.txt>
  97. #!include auth-deny.conf.ext
  98. #!include auth-master.conf.ext
  99. #!include auth-system.conf.ext
  100. !include auth-sql.conf.ext
  101. #!include auth-ldap.conf.ext
  102. #!include auth-passwdfile.conf.ext
  103. #!include auth-checkpassword.conf.ext
  104. #!include auth-vpopmail.conf.ext
  105. #!include auth-static.conf.ext